CVE-2024-45698 CRITICAL

CVE-2024-45698: D-Link WiFi router - OS Command Injection

Vendor D-Link
Product DIR-X4860 A1
Weakness CWE-78
Published September 16, 2024
Last update September 15, 2025

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Certain models of D-Link wireless routers do not properly validate user input in the telnet service, allowing unauthenticated remote attackers to use hard-coded credentials to log into telnet and inject arbitrary OS commands, which can then be executed on the device.

Key dates

02Disclosure timeline

September 16, 2024 CVE published
September 15, 2025 Record updated